Version 5.29.0 of the Terraform Cloudflare provider now includes two resources that expose Cloudflare’s AI Security for Apps feature to infrastructure‑as‑code pipelines. The change lets you turn the AI‑driven WAF on or off and supply custom topics that the model scores against, all from the same Terraform configuration that provisions zones, DNS, and other Cloudflare services.
New Terraform resources
The provider adds cloudflare_ai_security to toggle the feature per zone and cloudflare_ai_security_custom_topics to declare the list of topics used for scoring. Both resources require the zone identifier and accept simple boolean or list arguments, keeping the schema consistent with other Cloudflare resources.
resource "cloudflare_ai_security" "zone_ai_security" {
zone_id = var.cloudflare_zone_id
enabled = true
}
resource "cloudflare_ai_security_custom_topics" "zone_custom_topics" {
zone_id = var.cloudflare_zone_id
topics = [
{
label = "competitors"
topic = "seeking info on competitors"
}
]
}
These definitions are declarative; any change to the enabled flag or the topics array results in an update call to Cloudflare during the next terraform apply.
Integrating with existing rulesets
AI Security for Apps exposes fields that can be referenced in custom WAF rules built with the cloudflare_ruleset resource. By keeping the AI toggle and topic list in the same Terraform workspace as the ruleset, you avoid drift between detection settings and mitigation actions. When a new custom topic is added, the corresponding rule can be updated in the same commit, ensuring that policy changes are atomic and auditable.
Operational considerations
- State management: The new resources become part of the Terraform state file. Teams should treat the AI security configuration with the same backup and rotation policies as other Cloudflare resources.
- Change validation: Because AI Security for Apps influences request scoring, it is advisable to test changes in a staging zone before promoting to production. Terraform’s plan output will show the exact modifications, but functional testing of the scoring impact remains a separate step.
- Version lock: The resources are only available in provider version 5.29.0 and later. Pinning the provider version in
required_providersprevents accidental downgrades that would remove the resources from the configuration. - Drift detection: If the AI feature is toggled manually in the Cloudflare dashboard, Terraform will detect the difference on the next plan and propose a corrective update, preserving the intended state.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Engineers can now codify AI‑driven WAF controls alongside traditional firewall rules, gaining reproducibility and auditability. The primary action items are to upgrade the Cloudflare provider to 5.29.0, add the new resources to the zone’s Terraform module, and incorporate the AI fields into any custom cloudflare_ruleset definitions. Monitoring the impact of custom topics in a test environment before full rollout will help validate that the AI model behaves as expected without introducing false positives.